Meta (WhatsApp / Messenger) Webhooks
How to Test Meta / WhatsApp Webhooks Locally (2026)
Meta's Graph API sends webhooks for WhatsApp, Messenger, and Instagram events. Meta signs each payload with HMAC-SHA256 using your app secret (X-Hub-Signature-256), and requires a one-time GET handshake that echoes a hub.challenge value before it will deliver events.
Signature Header
X-Hub-Signature-256
Algorithm
HMAC-SHA256 (app secret)
Setup Guide
- 1Create a free HookSense endpoint at hooksense.com
- 2In the Meta App Dashboard → your app → Webhooks (or WhatsApp → Configuration)
- 3Set the Callback URL to your HookSense URL and choose a Verify Token
- 4Meta sends a GET handshake with hub.challenge — configure a HookSense custom response to echo it back (or forward to your app)
- 5Once verified, subscribe to the fields you need (e.g. messages, message_status)
- 6Send a test message to see the webhook land in HookSense
Common Meta (WhatsApp / Messenger) Webhook Events
messagesmessage_statusmessage_template_status_updatephone_number_quality_updateaccount_updatemessaging_postbacksfeedForward to Localhost
Use HookSense CLI to forward Meta (WhatsApp / Messenger) webhooks directly to your local development server:
npx hooksense listen -p 3000 --path /api/integrations/metaNo ngrok or tunnel setup required. Install with npm i -g hooksense or use npx.
Tips & Best Practices
- Meta signs with HMAC-SHA256 over the raw body using your app secret — the header is X-Hub-Signature-256 (sha256=...)
- The initial GET handshake must echo hub.challenge and match your hub.verify_token, or Meta won't enable the subscription
- WhatsApp Cloud API, Messenger, and Instagram all share this same webhook scheme
- Use HookSense to inspect the entry/changes payload structure before writing your handler
Related
Start Testing Meta (WhatsApp / Messenger) Webhooks
Create a free endpoint and receive your first Meta (WhatsApp / Messenger) webhook in seconds.
Get Started Free